Executive brief
Twenty is an open-source alternative to Salesforce used for customer relationship management and data management. The vulnerability allows authenticated users with read access to records but not to sensitive fields to bypass field-level permission checks through a GraphQL resolver, potentially exposing restricted data like confidential customer information or internal notes that should have been hidden.
Technical details
The groupBy-with-records GraphQL resolver in Twenty before version 2.35.0 fails to properly validate field-level and row-level permissions before returning data. An authenticated attacker with canReadObjectRecords permission but canReadFieldValue set to false can exploit this to retrieve restricted field values that would normally be denied. The vulnerability exists in the resolver logic itself, which processes groupBy queries without enforcing per-field permission checks. This is a permission-bypass issue affecting GraphQL API access and requires valid authentication to exploit, making it actionable only by authenticated users with some baseline permissions.
Affected products
- Twenty Twenty before 2.35.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 2.35.0